Attribute Consent

CAS provides the ability to enforce user-informed consent upon attribute release. Practically, this means that prior to accessing the target application, the user will be presented with a collection of attributes allowed to be released to the application with options to either proceed or deny the release of said attributes. There are also additional options to indicate how should underlying changes in the attribute release policy be considered by the consent engine. Users are also provided the ability to set up reminders in the event that no change is detected in the attribute release policy.

Consent attribute records stored in the configured repository are signed and encrypted.

Support is enabled by including the following module in the WAR Overlay:

1
2
3
4
5

<dependency>
  <groupId>org.apereo.cas</groupId>
  <artifactId>cas-server-support-consent-webflow</artifactId>
  <version>${cas.version}</version>
</dependency>

1

implementation "org.apereo.cas:cas-server-support-consent-webflow:${project.'cas.version'}"

1
2
3
4
5
6
7
8
9

dependencyManagement {
  imports {
    mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
  }
}

dependencies {  
  implementation "org.apereo.cas:cas-server-support-consent-webflow"
}

Actuator Endpoints

The following endpoints are provided by CAS:

Delete a consent decision for principal using a decision id.

boolean application/json

AttributeConsentReportEndpoint.revokeConsents(java.lang.String,long)
org.apereo.cas.consent.AttributeConsentReportEndpoint

Get consent decisions for principal.

Collection application/json

AttributeConsentReportEndpoint.consentDecisions(java.lang.String)
org.apereo.cas.consent.AttributeConsentReportEndpoint

Export consent decisions as a zip file.

ResponseEntity application/octet-stream

AttributeConsentReportEndpoint.export()
org.apereo.cas.consent.AttributeConsentReportEndpoint

Import a consent decision as a JSON document.

HttpStatus application/json

AttributeConsentReportEndpoint.importAccount(javax.servlet.http.HttpServletRequest)
org.apereo.cas.consent.AttributeConsentReportEndpoint


Attribute Selection

By default, all attributes that are marked for release do qualify for consent. To control this process, you may define a consent policy that indicates a criteria by which attribute selection for consent is carried out.

The policy assigned to each service includes the following features:

Field Description
excludedAttributes Exclude the indicated attributes from consent.
includeOnlyAttributes Force-include the indicated attributes in consent, provided attributes are resolved.
status Controls whether consent for this service should be activated. See below for activation rules.

A sample definition follows:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

{
  "@class" : "org.apereo.cas.services.RegexRegisteredService",
  "serviceId" : "sample",
  "name" : "sample",
  "id" : 100,
  "description" : "sample",
  "attributeReleasePolicy" : {
    "@class" : "org.apereo.cas.services.ReturnAllAttributeReleasePolicy",
    "consentPolicy": {
      "@class": "org.apereo.cas.services.consent.DefaultRegisteredServiceConsentPolicy",
      "excludedAttributes": ["java.util.LinkedHashSet", ["test"]],
      "includeOnlyAttributes": ["java.util.LinkedHashSet", ["test"]],
      "status": "FALSE"
    }
  }
}

Activation

See this guide for more details.

Storage

User consent decisions may be stored and remembered using one of the following options.

Storage Description
CouchDb See this guide.
Custom See this guide.
Groovy See this guide.
JDBC See this guide.
JSON See this guide.
LDAP See this guide.
MongoDb See this guide.
Redis See this guide.
REST See this guide.